Patternis privacy policy
Effective date: 16 October 2026
Who we are
Patternis is a GitHub App, website and web service made by Astra Forge LLC, an Arizona limited liability company. In this policy "we" means Astra Forge LLC and "you" means the person or organisation that installs Patternis, and anyone whose activity in an installed repository reaches us.
Patternis decides when work in your repository should run and on which model tier, starts that work in your own GitHub Actions runner, and keeps a ledger of what it decided. The AI work itself runs on your runner, with your provider key, and does not pass through us. That design is the reason this policy is short.
This policy covers the Patternis website at patternis.dev, the Patternis service at api.patternis.dev, and the Patternis GitHub App. The beta is offered only in the United States. It describes how we handle information today; what it describes can change, as "Changes to this policy" explains.
What we collect and why
About your installation. When you install the App, GitHub tells us the installation's number and the numeric id, login, and type (user or organisation) of the account it was installed on. We keep the numeric id on the installation record to identify that account across its installations and to follow a rename GitHub reports while the App is installed. Trial eligibility is checked by GitHub login, not by that numeric id: the reduced trial-used record contains the login and dates only. If a rename happens after uninstall, that retained record may not follow it, and an installation under the new login may be treated as eligible for another trial. If you installed on a personal account, that login is your GitHub username.
A one-time look at your public GitHub profile. When a new installation arrives we fetch the installing account's public GitHub profile once. We use it to work out two things, how old the account is and how many public repositories it has, and feed them into an automated check against trial abuse. We keep the outcome of that check (reason codes such as "account under 90 days old", and a score), not the profile, the age or the count. In the service as it stands this score never refuses a trial on its own. A retained trial-used record refuses another trial under the same GitHub login while the record remains, for up to 24 months after trial end. GitHub-reported renames are followed while the trial remains linked to an installed App; after uninstall, the reduced record has no numeric account id to match a later rename, so a new login may be treated as eligible. The same login remains blocked while its record is retained.
Events from your repositories. GitHub delivers an event to us whenever an issue, a pull request or a comment on one is created or changed in the repositories you install the App on. Only some of those are requests for work (see the Terms); the rest are ignored. Those events include what people wrote: issue and pull-request titles and descriptions, and comment text. We read that text in memory for two purposes only: to see whether a comment asks for Patternis (by starting a line with @patternis), and to estimate how large a task is. We do not store that text and we do not send it anywhere. We store a record that each event arrived, with its GitHub delivery id, event type, time and processing outcome, so that a lost event can be told apart from one never received.
The ledger ("receipts"). For every decision to act or refuse, we record a receipt: what kind of decision it was, the reason code, the model tier chosen, the units charged, the issue or pull-request number, the task id, the name and GitHub number of the repository the work was about, and, once your runner reports back, the workflow run id. Receipt numbers shown outside the service are scrambled and do not reveal how many receipts exist. Receipts are how you and we can see what Patternis did and why. A workflow in one of your repositories can read that repository's receipts (see "Who can read your ledger").
What your runner reports back. After a task runs, the workflow in your repository sends us a small receipt (task id, task type, success or failure, run id, repository name, issue or pull-request number) and, if your AI provider's response said so, how much rate-limit capacity remains and when it resets. We use the capacity number to route later work. Your runner proves who it is with a short-lived token that GitHub issues for that run. We check the token and then discard it; we do not keep any of the details it carries.
Subscribing. To subscribe, you sign in with GitHub on our subscribe page, so that we can check that you administer the GitHub account you are paying for. We use that sign-in once: we read your GitHub user number and login, the Patternis installations you can see and, for an organisation, your membership to check that you are one of its owners; then we revoke the sign-in. The App requests organisation members read permission for this check. We do not store the sign-in or what we read with it. The sign-in sets a cookie holding only its security values, which lasts at most 10 minutes and is cleared on return. A second cookie may hold a random value tying your installation choice to that page for at most 10 minutes. We send Stripe your installation, GitHub account and GitHub user numbers to tie payment to the right installation. We record that checkout was started, with the installation number and Stripe session number. When a subscription starts, we record the time it was confirmed, by which you had accepted the Terms, and the version you accepted. Your subscription record also holds the billing month's dates and units used and, while a payment is overdue, the date it became overdue.
Paying. You pay on Stripe's payment page (Stripe Checkout), through Stripe's Managed Payments service. Link, Stripe's payment service, is the merchant of record: your purchase shows as "Sold through Link", your receipts and invoices come from Link, and you manage or cancel your subscription at link.com. Stripe and Link collect your payment details, and any contact and address details the payment page asks for, directly and under their own privacy policies: Stripe's and Link's. We do not see your card number. From Stripe we receive signed notices, and we keep only Stripe's identifiers for your customer record, subscription and invoices, the identifiers of the notices we have already applied, and the state of your subscription. Stripe's notices to us about your payments can include the name, email address and billing address you give on the payment page. Our service does not store them; they stay in our Stripe account, where we can see them, until Stripe deletes them.
Email. If you write to one of our addresses, we receive your email address and message. Mail to our patternis.dev addresses is forwarded by Cloudflare to Gmail. We use it to answer you and, for a request to see or delete your information, to send the one-time code described under "Your choices".
We use no analytics or tracking on any page we serve, and the only cookies we set are the two short-lived cookies of the subscribe sign-in. We do not sell personal information, and we do not use anything we receive for advertising or to train AI models; the Patternis service contains no AI model.
Logs. Our own code writes no per-request access log. On our current Hobby workspace, Render makes our service's standard-output and standard-error logs available for 7 days. Render documents HTTP request logs for Pro workspaces and above. The current evidence does not establish that HTTP request logs are available for Patternis's Hobby workspace, or whether Render records or retains client IP addresses or user-agent data while operating the service.
What we do not receive
Most privacy policies promise not to misuse data they hold. For the items below we do not hold the data at all, because, as Patternis is built today, it does not reach us. For most of them no permission we hold could fetch it; where one could, the item says so.
- Your AI provider key. It is stored as a secret in your own repository and read only by a job on your own runner. No part of our service accepts it.
- Your source code and pull-request diffs. The App does not ask GitHub for permission to read repository contents. Your runner fetches the diff with its own token and sends it straight to your AI provider. This one rests on what our code does, not on permissions alone: the pull-request permission the App holds would let it read a pull request's changed lines through GitHub's API, and our code does not make that call (see Security).
- The AI's review, summary or triage text. Your runner writes it to the workflow run's summary page in your repository. The receipt your runner sends us has no field for it, and our service would drop one if it appeared.
- The prompt sent to your AI provider. It is built and sent on your runner.
- Passwords. Patternis has no passwords and no user accounts. The one sign-in is GitHub's own, on the subscribe page, and we do not keep it.
One qualification, stated plainly: text people type into issues, pull-request descriptions and comments does reach us inside GitHub's event notices, as described above. It is read in memory and not kept.
Where it is stored, and for how long
Everything our service stores is kept in a Postgres database hosted by Render in its Oregon (United States) region. Emails you send us are kept in our Gmail mailbox, and logs in Render's logging, as the table below says. If you are outside the United States, your information is processed in the United States.
The table below shows how long we currently keep information. These are current practices, not commitments, and they can change. Our ledger is append-only in normal operation, so that it can serve as evidence of what Patternis did. Today, records leave it through a logged purge of one installation's records, run after the period in the table or on a verified deletion request.
| What | How long we currently keep it |
|---|---|
| Everything tied to your installation: installation, trial, ledger and capacity records, and the outcome of the trial check | While the App is installed, and for 90 days after we record that you uninstalled it. Then we delete it, except the records in the next rows. If a subscription is still active then, we wait until it has been cancelled, then delete. |
| The record that a GitHub login has used its free trial: the login and trial dates, nothing else | 24 months from the end of that trial. It remains after uninstall and a deletion request, and blocks another trial under the same login while retained. It has no numeric account id; a rename after uninstall may not follow the record, so a new login may be treated as eligible. |
| Stripe identifiers and the Terms version and acceptance time kept with them | 7 years after the last payment that collected money; a $0 trial invoice is not one. Stripe keeps the payment records themselves under its own policy. |
| A payment or subscription that cannot be connected to an installation | A note of its Stripe number for 90 days, to sort it out and refuse a late payment, then delete it. |
| Records that an event arrived | 30 days |
| Emails you send us | For a request to see or delete your data, 30 days after the access reply or deletion is done. Other emails have no current deletion schedule; you may ask us to delete them. This is an operator procedure, not an automated service deletion. |
| Patternis service output written to Render logs | Available in Render for 7 days under our current Hobby workspace plan. This is a documented visibility period, not a verified physical-erasure deadline. Our application writes no per-request access log. |
| Database recovery copies and maintenance exports | The current Render Hobby workspace offers point-in-time recovery for the past 3 days. Before a migration or deletion sitting, the operator may create a manual database export. Render labels its export files as retained at least 7 days. If an export is downloaded or copied elsewhere, it remains there until it is separately handled. These availability and handling facts do not establish when deleted rows are physically erased. |
Who we share with
We do not sell or rent information. The following providers handle it to run Patternis:
| Provider | What they do for Patternis | What they can see |
|---|---|---|
| GitHub | Delivers events to us, runs your workflow, hosts the comments we post, and runs the sign-in when you subscribe | Your repositories, under your own agreement with GitHub |
| Render (Render Services, Inc.) | Hosts the Patternis website, service and database | Everything we store, Patternis service output sent to Render logs, database recovery copies, and maintenance exports held on Render. The current evidence does not establish whether Render records or retains client IP addresses or user-agent data for Patternis's Hobby workspace. |
| Render's own subprocessors: Amazon Web Services, Google Cloud Platform, Cloudflare, ClickHouse | Infrastructure beneath Render, per Render's published list; Render routes this service's traffic through Cloudflare's network | As Render's subprocessors |
| Cloudflare | Answers DNS lookups for patternis.dev, and forwards email sent to our patternis.dev addresses | DNS queries, and the emails you send us |
| Google (Gmail) | Hosts the mailbox our email addresses forward to | The emails you send us |
| Stripe, and Link, Stripe's payment service | Run the payment page and take payments through Stripe Managed Payments. Link is the merchant of record: it sends receipts and invoices and handles cancellation at link.com | Your payment details, and the contact and address details the payment page asks for, collected by them directly |
Things we post where others can see them. When a task finishes, or when we refuse work for a reason you can act on (such as an ended trial), we may post a short comment on the issue or pull request. The workflow run we start shows its task id, task type, issue or pull-request number and tier. Anyone who can read your repository can read these, which on a public repository means anyone.
Comments about your subscription, such as the monthly limit or a payment problem, are posted in your repository. Anyone who can read that repository can read them. They never show a name, an email address, or an amount of money.
When a payment cannot be matched to an installation, or a paying installation uninstalls, the service opens an issue in a private GitHub repository of Astra Forge so we can fix it. The issue holds Stripe and GitHub numbers for the subscription and installation, and no name or email address. We delete the issue within 30 days after the case is resolved. During the beta, the same repository also receives weekly counts of trials and subscriptions, with no identifiers.
Who can read your ledger. A GitHub Actions workflow can read only receipts recorded for its own repository's GitHub number, while that repository belonged to the account where Patternis is installed, and only when GitHub confirms the workflow's account. Receipts written before migration 0004 have no repository number and no workflow can read them. Anyone who can run a workflow in that repository can read its available receipts.
Your AI provider (Anthropic, in this version) receives your diffs and prompts from your runner under your own agreement with them. We are not a party to that and do not contact your provider.
Legal requests. We may disclose information when we believe the law requires it. We tell the affected customer only when and as the law requires.
If the business changes hands. If Patternis is sold or transferred, the information we hold may be transferred with it, as the law allows.
Your choices
- Stop Patternis. Uninstall the App from your GitHub settings. You can also delete the workflow file and the
PATTERNIS_PROVIDER_KEYsecret from your repository; without them no work can run. - See what we recorded. Your ledger is readable from your own workflows at
GET /receipts. For anything else we hold, email privacy@patternis.dev. We answer a request when and as the law requires and may answer others; under current procedure we answer within 30 days after the one-time-code check below. - Ask us to delete your data. Email privacy@patternis.dev. We email a one-time code and ask you to post it in a public gist or the profile README of the GitHub account. This identity check and the deletion are currently manual; P14's self-service flow is not deployed. We delete what applicable law requires, when and as it requires, and may delete more. Under current procedure, if Patternis is still installed, we delete your ledger, capacity readings and trial decisions, and keep the installation, trial, subscription and billing receipts needed to run it; those go 90 days after uninstall. If Patternis is no longer installed, we delete its records, subject to the retention table. We keep the trial-used record and tax/accounting records for the periods in the table. If a subscription on an uninstalled installation is still active, we wait until it is cancelled, with no 90-day override. Deleted information may remain in hosting-provider logs, database recovery copies, or maintenance exports after it is deleted from Patternis's active database. A maintenance export, if it contains the deleted information, must be handled separately wherever it is hosted. Stripe and Link control deletion of payment information they hold.
Anyone can ask, wherever they live: ask us at privacy@patternis.dev what we hold about you, or ask us to delete it. We act on a request when and as the law that applies to the requester requires, and may act on others. We check a request to see your information the same way as a request to delete it.
Security
What the code does, and what it relies on vendors for, without overstating either:
- Every event from GitHub is signature-checked before anything in it is trusted, with a constant-time comparison. Unsigned or forged events are refused.
- Your runner's reports are authenticated with a short-lived token GitHub issues for that run, checked for issuer, audience, expiry and signature. There is no shared password between your repository and us to leak.
- The installation access tokens we get from GitHub are kept in memory only, not in the database or logs.
- We ask GitHub for five permissions: repository metadata (read), pull requests (write), issues (write), Actions (write), and organisation members (read). The last lets us check that the person subscribing an organisation is one of its owners. None reads or changes repository files. The permissions are broader than our current use: our code posts comments and formal-notice issues, starts
patternis-runner.yml, and checks organisation ownership; it does not read a diff, log, or artifact. - Our own secrets (the App's signing key and webhook keys) are held as Render environment variables, not in our code repository.
- In transit: Render serves
api.patternis.devover TLS and redirects plain HTTP to HTTPS;.devdomains are HTTPS-only in browsers. These are Render's and the browsers' mechanisms. - At rest: Render states that its Postgres databases, replicas and backups are encrypted with AES-256. That is Render's encryption; Patternis adds none of its own.
- Database access from outside Render. The database accepts no outside connection except while we run a migration or deletion, when we open it to our own network address alone and close it again.
- What we do not claim. Patternis has no security certification of its own (Render's certifications are Render's), has had no independent security audit or penetration test, and does not itself require TLS on the connection between its service and its database inside Render's network.
If a security breach affects your information, we will notify you when, and in the way, the law requires. We may do that by opening an issue in a repository of your installation, by posting a notice on patternis.dev, or both. If you have uninstalled Patternis we can no longer open issues in your repositories, so a notice on patternis.dev may be the only one you see.
Children
Patternis is a developer tool for business and professional work. The person who installs Patternis on an account, or subscribes to it, must be 18 or older and use it for work. It is not directed at children. We do not collect anyone's age, and we do not knowingly collect information about children.
Changes to this policy
If we change this policy, we post the new version at https://patternis.dev/privacy with a new effective date. Where the law requires us to give notice, or to get consent, before a change applies to information we already hold, we do so.
Contact
Astra Forge LLC, an Arizona limited liability company.
- Privacy questions, and requests to see or delete your information: privacy@patternis.dev
- Support: support@patternis.dev
- Legal notices: legal@patternis.dev